Spectrum events

The descriptions below detail the fields available for spectrum_events.

Field	Value	Type
Application	The unique public ID of the application on which the event occurred	string
ClientAsn	Client AS number	int
ClientBytes	The number of bytes read from the client by the Spectrum service	int
ClientCountry	Country of the client IP address	string
ClientIP	Client IP address	string
ClientMatchedIpFirewall	Whether the connection matched any IP Firewall rules. UNKNOWN = No match or Firewall not enabled for spectrum; UNKNOWN	ALLOW	BLOCK_ERROR	BLOCK_IP	BLOCK_COUNTRY	BLOCK_ASN	WHITELIST_IP	WHITELIST_COUNTRY	WHITELIST_ASN	string
ClientPort	Client port	int
ClientProto	Transport protocol used by client; tcp	udp	unix	string
ClientTcpRtt	The TCP round-trip time in nanoseconds between the client and Spectrum	int
ClientTlsCipher	The cipher negotiated between the client and Spectrum. In v1, an unknown cipher returned as “Unknown.” In v2, it’s returned as “UNK.”	string
ClientTlsClientHelloServerName	The server name in the Client Hello message from client to Spectrum	string
ClientTlsProtocol	The TLS version negotiated between the client and Spectrum; unknown	none	SSLv3	TLSv1	TLSv1.1	TLSv1.2	TLSv1.3	string
ClientTlsStatus	Indicates state of TLS session from the client to Spectrum; UNKNOWN	OK	INTERNAL_ERROR	INVALID_CONFIG	INVALID_SNI	HANDSHAKE_FAILED	KEYLESS_RPC	string
ColoCode	IATA airport code of data center that received the request	string
ConnectTimestamp	Timestamp at which both legs of the connection (client/edge, edge/origin or nexthop) were established	int or string
DisconnectTimestamp	Timestamp at which the connection was closed	int or string
Event	connect	disconnect	clientFiltered	tlsError	resolveOrigin	originError	string
IpFirewall	Whether IP Firewall was enabled at time of connection	bool
OriginBytes	The number of bytes read from the origin by Spectrum	int
OriginIP	Origin IP address	string
OriginPort	Origin port	int
OriginProto	Transport protocol used by origin; tcp	udp	unix	string
OriginTcpRtt	The TCP round-trip time in nanoseconds between Spectrum and the origin	int
OriginTlsCipher	The cipher negotiated between Spectrum and the origin. In v1, an unknown cipher returned as “Unknown.” In v2, it’s returned as “UNK.”	string
OriginTlsFingerprint	SHA256 hash of origin certificate. In v1, an unknown SHA256 hash is returned as “0000000000000000000000000000000000000000000000000000000000000000.” In v2, it’s returned as an empty string.	string
OriginTlsMode	If and how the upstream connection is encrypted; unknown	off	flexible	full	strict	string
OriginTlsProtocol	The TLS version negotiated between Spectrum and the origin; unknown	none	SSLv3	TLSv1	TLSv1.1	TLSv1.2	TLSv1.3	string
OriginTlsStatus	The state of the TLS session from Spectrum to the origin; UNKNOWN	OK	INTERNAL_ERROR	INVALID_CONFIG	INVALID_SNI	HANDSHAKE_FAILED	KEYLESS_RPC	string
ProxyProtocol	Which form of proxy protocol is applied to the given connection; off	v1	v2	simple	string
Status	A code indicating reason for connection closure	int
Timestamp	Timestamp at which the event took place	int or string